PT-2017-18614 · Atlassian · Bamboo

Inhibitor181 + 1 · Publicado 2017-06-14 · Atualizado 2024-10-16 · CVE-2017-8907

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Bamboo versions 5.x through 5.15.6 Atlassian Bamboo versions 6.x through 6.0.0

Description The issue arises from incorrect permission checks for users creating deployment projects. An attacker with login access to Bamboo, but without edit permission for deployment projects, can exploit this to create a deployment project and execute arbitrary code on an available Bamboo Agent, given an existing plan with a green build. By default, a local agent is enabled, allowing code execution on the system hosting Bamboo as the user running Bamboo.

Recommendations For Atlassian Bamboo versions 5.x through 5.15.6, update to version 5.15.7 or later. For Atlassian Bamboo versions 6.x through 6.0.0, update to version 6.0.1 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2017-8907

Produtos afetados

Bamboo

Referências · 6

• https://t.me/cvenotify/98273 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-8907 · Aviso do Fabricante
• http://securityfocus.com/bid/99090 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8907 · Nota de Segurança
• https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8907 · Nota de Segurança